1. Sarbanes-Oxley: Where Information Technology, Finance, and Ethics Meet
CHAPTER 4
ETHICS AND
INFORMATION SECURITY
Opening Case
Sarbanes-Oxley: Where Information Technology, Finance, and Ethics Meet

2. Chapter Four Overview SECTION 4.1 - ETHICS
Information Ethics
Developing Information Management Policies
Ethics in the Workplace
SECTION INFORMATION SECURITY
Protecting Intellectual Assets
The First Line of Defense - People
The Second Line of Defense - Technology

3. Organizational Fundamentals – Ethics and Security
Ethics and security are two fundamental building blocks that organizations must base their businesses on to be successful
In recent years, such events as the Enron and Martha Stewart, along with 9/11 have shed new light on the meaning of ethics and security

4. SECTION 4.1
ETHICS

5. LEARNING OUTCOMES
Explain the ethical issues surrounding information technology
Identify the differences between an ethical computer use policy and an acceptable computer use policy
Describe the relationship between an privacy policy and an Internet use policy

6. LEARNING OUTCOMES Explain the effects of spam on an organization
Summarize the different monitoring technologies and explain the importance of an employee monitoring policy

7. ETHICS
Ethics – the principles and standards that guide our behavior toward other people
Issues affected by technology advances
Intellectual property
Copyright
Fair use doctrine
Pirated software
Counterfeit software

8. ETHICS Privacy is a major ethical issue
Privacy – the right to be left alone when you want to be, to have control over your own personal possessions, and not to be observed without your consent
Confidentiality – the assurance that messages and information are available only to those who are authorized to view them

9. ETHICS One of the main ingredients in trust is privacy
Primary reasons privacy issues lost trust for e-business

10. INFORMATION ETHICS
Individuals form the only ethical component of IT

11. Information Has No Ethics
Acting ethically and legally are not always the same

12. Information Has No Ethics
Information does not care how it is used
Information will not stop itself from sending spam, viruses, or highly-sensitive information
Information cannot delete or preserve itself

13. DEVELOPING INFORMATION MANAGEMENT POLICIES
Organizations strive to build a corporate culture based on ethical principles that employees can understand and implement
ePolicies typically include:
Ethical computer use policy
Information privacy policy
Acceptable use policy
privacy policy
Internet use policy
Anti-spam policy

14. Ethical Computer Use Policy
Ethical computer use policy – contains general principles to guide computer user behavior
The ethical computer user policy ensures all users are informed of the rules and, by agreeing to use the system on that basis, consent to abide by the rules

15. Ethical Computer Use Policy

16. Information Privacy Policy
The unethical use of information typically occurs “unintentionally” when it is used for new purposes
For example, social security numbers started as a way to identify government retirement benefits and are now used as a sort of universal personal ID
Information privacy policy - contains general principles regarding information privacy

17. Information Privacy Policy
Information privacy policy guidelines
Adoption and implementation of a privacy policy
Notice and disclosure
Choice and consent
Information security
Information quality and access

18. Acceptable Use Policy
Acceptable use policy (AUP) – a policy that a user must agree to follow in order to be provided access to a network or to the Internet
An AUP usually contains a nonrepudiation clause
Nonrepudiation – a contractual stipulation to ensure that e-business participants do not deny (repudiate) their online actions

19. Acceptable Use Policy

20. Privacy Policy
Organizations can mitigate the risks of and instant messaging communication tools by implementing and adhering to an privacy policy
privacy policy – details the extent to which messages may be read by others

21. Privacy Policy

22. Privacy Policy

23. Internet Use Policy
Internet use policy – contains general principles to guide the proper use of the Internet

24. Anti-Spam Policy Spam – unsolicited e-mail
Spam accounts for 40% to 60% of most organizations’ and cost U.S. businesses over $14 billion in 2005
Anti-spam policy – simply states that users will not send unsolicited s (or spam)

25. ETHICS IN THE WORKPLACE
Workplace monitoring is a concern for many employees
Organizations can be held financially responsible for their employees’ actions
The dilemma surrounding employee monitoring in the workplace is that an organization is placing itself at risk if it fails to monitor its employees, however, some people feel that monitoring employees is unethical

26. Monitoring Technologies

27. Monitoring Technologies
Monitoring – tracking people’s activities by such measures as number of keystrokes, error rate, and number of transactions processed
Common monitoring technologies include:
Key logger or key trapper software
Hardware key logger
Cookie
Adware
Spyware
Web log
Clickstream

28. Employee Monitoring Policies
Employee monitoring policies – explicitly state how, when, and where the company monitors its employees

29. OPENING CASE QUESTIONS Sarbanes-Oxley
Define the relationship between ethics and the Sarbanes-Oxley Act
Why is records management an area of concern for the entire organization and not just the IT department?
Identify two policies an organization can implement to achieve Sarbanes-Oxley compliance?

30. OPENING CASE QUESTIONS Sarbanes-Oxley
What ethical dilemmas are being solved by implementing Sarbanes-Oxley?
What is the biggest roadblock for organizations that are attempting to achieve Sarbanes-Oxley compliance?

31. SECTION 4.2
INFORMATION
SECURITY

32. LEARNING OUTCOMES
Describe the relationship between information security policies and an information security plan
Summarize the five steps to creating an information security plan
Provide an example of each of the three primary security areas: (1) authentication and authorization, (2) prevention and resistance, and (3) detection and response
Describe the relationships and differences between hackers and viruses

33. PROTECTING INTELLECTUAL ASSETS
Organizational information is intellectual capital - it must be protected
Information security – the protection of information from accidental or intentional misuse by persons inside or outside an organization
E-business automatically creates tremendous information security risks for organizations

34. PROTECTING INTELLECTUAL ASSETS

35. PROTECTING INTELLECTUAL ASSETS

36. THE FIRST LINE OF DEFENSE - PEOPLE
Organizations must enable employees, customers, and partners to access information electronically
The biggest issue surrounding information security is not a technical issue, but a people issue
33% of security incidents originate within the organization
Insiders – legitimate users who purposely or accidentally misuse their access to the environment and cause some kind of business-affecting incident

37. THE FIRST LINE OF DEFENSE - PEOPLE
The first line of defense an organization should follow to help combat insider issues is to develop information security policies and an information security plan
Information security policies – identify the rules required to maintain information security
Information security plan – details how an organization will implement the information security policies

38. THE FIRST LINE OF DEFENSE - PEOPLE
Hackers frequently use “social engineering” to obtain password
Social engineering – using one’s social skills to trick people into revealing access credentials or other information valuable to the attacker

39. THE FIRST LINE OF DEFENSE - PEOPLE
Five steps to creating an information security plan:
Develop the information security policies
Communicate the information security policies
Identify critical information assets and risks
Test and reevaluate risks
Obtain stakeholder support

40. THE FIRST LINE OF DEFENSE - PEOPLE

41. THE SECOND LINE OF DEFENSE - TECHNOLOGY
There are three primary information technology security areas
Authentication and authorization
Prevention and resistance
Detection and response

42. Authentication and Authorization
Authentication – a method for confirming users’ identities
Authorization – the process of giving someone permission to do or have something
The most secure type of authentication involves:
Something the user knows such as a user ID and password
Something the user has such as a smart card or token
Something that is part of the user such as a fingerprint or voice signature

43. Something the User Knows Such As a User ID and Password
This is the most common way to identify individual users and typically contains a user ID and a password
This is also the most ineffective form of authentication
Over 50 percent of help-desk calls are password related

44. Something the User Knows Such As a User ID and Password
Identity theft – the forging of someone’s identity for the purpose of fraud
Phishing – a technique to gain personal information for the purpose of identity theft, usually by means of fraudulent

45. Something the User Knows Such As a User ID and Password

46. Something the User Knows Such As a User ID and Password
Smart cards and tokens are more effective than a user ID and a password
Tokens – small electronic devices that change user passwords automatically
Smart card – a device that is around the same size as a credit card, containing embedded technologies that can store information and small amounts of software to perform some limited processing

47. Unfortunately, this method can be costly and intrusive
Something That Is Part Of The User Such As a Fingerprint or Voice Signature
This is by far the best and most effective way to manage authentication
Biometrics – the identification of a user based on a physical characteristic, such as a fingerprint, iris, face, voice, or handwriting
Unfortunately, this method can be costly and intrusive

48. Prevention and Resistance
Downtime can cost an organization anywhere from $100 to $1 million per hour
Technologies available to help prevent and build resistance to attacks include:
Content filtering
Encryption
Firewalls

49. Content Filtering
Organizations can use content filtering technologies to filter and prevent s containing sensitive information from transmitting and stop spam and viruses from spreading.
Content filtering – occurs when organizations use software that filters content to prevent the transmission of unauthorized information
Spam – a form of unsolicited
Corporate losses caused by Spam

50. Encryption
If there is an information security breach and the information was encrypted, the person stealing the information would be unable to read it
Encryption – scrambles information into an alternative form that requires a key or password to decrypt the information
Public key encryption (PKE) – an encryption system that uses two keys: a public key for everyone and a private key for the recipient

51. Encryption

52. Firewalls
One of the most common defenses for preventing a security breach is a firewall
Firewall – hardware and/or software that guards a private network by analyzing the information leaving and entering the network

53. Firewalls
Sample firewall architecture connecting systems located in Chicago, New York, and Boston

54. Detection and Response
If prevention and resistance strategies fail and there is a security breach, an organization can use detection and response technologies to mitigate the damage
Antivirus software is the most common type of detection and response technology

55. Detection and Response
Hacker - people very knowledgeable about computers who use their knowledge to invade other people’s computers
White-hat hacker
Black-hat hacker
Hactivist
Script kiddies or script bunnies
Cracker
Cyberterrorist

56. Detection and Response
Virus - software written with malicious intent to cause annoyance or damage
Worm
Denial-of-service attack (DoS)
Distributed denial-of-service attack (DDoS)
Trojan-horse virus
Backdoor program
Polymorphic virus and worm

57. Detection and Response
Security threats to e-business include:
Elevation of privilege
Hoaxes
Malicious code
Spoofing
Spyware
Sniffer
Packet tampering

58. OPENING CASE QUESTIONS Sarbanes-Oxley
What information security dilemmas are being solved by implementing Sarbanes-Oxley?
How can Sarbanes-Oxley help protect a company’s information security?
What impact does implementing Sarbanes-Oxley have on information security in a small business?
What is the biggest information security roadblock for organizations attempting to achieve Sarbanes-Oxley compliance?

59. CLOSING CASE ONE Banks Banking on Security
What reason would a bank have for not wanting to adopt an online-transfer delay policy?
What are the two primary lines of security defense and why are they important to financial institutions?
Explain the differences between the types of security offered by the banks in the case

60. CLOSING CASE ONE Banks Banking on Security
What additional types of security, not mentioned in the case above, would you recommend a bank implement?
Identify three policies a bank should implement to help it improve information security
Describe monitoring policies along with the best way for a bank to implement monitoring technologies

61. CLOSING CASE TWO Hacker Hunters
What types of technology could big retailers use to prevent identity thieves from purchasing merchandise?
What can organizations do to protect themselves from hackers looking to steal account data?
Authorities frequently tap online service providers to track down hackers. Do you think it is ethical for authorities to tap an online service provider and read people’s ? Why or why not?

62. CLOSING CASE TWO Hacker Hunters
Do you think it was ethical for authorities to use one of the high-ranking officials to trap other gang members? Why or why not?
In a team, research the Internet and find the best ways to protect yourself from identity theft

63. CLOSING CASE THREE Thinking Like the Enemy
How could an organization benefit from attending one of the courses offered at the Intense School?
What are the two primary lines of security defense and how can organizational employees use the information taught by the Intense School when drafting an information security plan?
Determine the difference between the two primary courses offered at the Intense school, “Professional Hacking Boot Camp” and “Social Engineering in Two Days.” Which course is more important for organizational employees to attend?

64. CLOSING CASE THREE Thinking Like the Enemy
If your employer sent you to take a course at the Intense School, which one would you choose and why?
What are the ethical dilemmas involved with having such a course offered by a private company?